sublimehighRule

MalwareBazaar: Malicious attachment hash (trusted reporters)

Detects if an attachment's SHA256 hash matches a SHA256 hash reported as malware on MalwareBazaar by trusted reporters from untrusted senders.

MITRE ATT&CK

T1566.001 T1204.002 T1486

Detection Query

type.inbound
and any(attachments,
        .sha256 in $abuse_ch_malwarebazaar_sha256_trusted_reporters
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Abusech: MalwareBazaar

Raw Content

name: "MalwareBazaar: Malicious attachment hash (trusted reporters)"
description: "Detects if an attachment's SHA256 hash matches a SHA256 hash reported as malware on MalwareBazaar by trusted reporters from untrusted senders."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(attachments,
          .sha256 in $abuse_ch_malwarebazaar_sha256_trusted_reporters
  )
tags:
  - "Abusech: MalwareBazaar"
attack_types:
  - "Malware/Ransomware"
detection_methods:
  - "File analysis"
  - "Sender analysis"
  - "Threat intelligence"
id: "5b5c9c3e-92c2-56cd-ad0d-1a2e195fa2b4"